filelock: Remove locks reliably when fcntl/close race is detected

JIRA: https://issues.redhat.com/browse/RHEL-50176

CVE: CVE-2024-41012

Conflicts: minor differences since missing upstream patches including
4ca52f5 (filelock: have fs/locks.c deal with file_lock_core directly)
(e.g. those patches replace fl_type with flc_type and are not required here).

commit 3cad1bc
Author: Jann Horn <jannh@google.com>
Date:   Tue Jul 2 18:26:52 2024 +0200

    filelock: Remove locks reliably when fcntl/close race is detected

    When fcntl_setlk() races with close(), it removes the created lock with
    do_lock_file_wait().
    However, LSMs can allow the first do_lock_file_wait() that created the lock
    while denying the second do_lock_file_wait() that tries to remove the lock.
    In theory (but AFAIK not in practice), posix_lock_file() could also fail to
    remove a lock due to GFP_KERNEL allocation failure (when splitting a range
    in the middle).

    After the bug has been triggered, use-after-free reads will occur in
    lock_get_status() when userspace reads /proc/locks. This can likely be used
    to read arbitrary kernel memory, but can't corrupt kernel memory.
    This only affects systems with SELinux / Smack / AppArmor / BPF-LSM in
    enforcing mode and only works from some security contexts.

    Fix it by calling locks_remove_posix() instead, which is designed to
    reliably get rid of POSIX locks associated with the given file and
    files_struct and is also used by filp_flush().

    Fixes: c293621 ("[PATCH] stale POSIX lock handling")
    Cc: stable@kernel.org
    Link: https://bugs.chromium.org/p/project-zero/issues/detail?id=2563
    Signed-off-by: Jann Horn <jannh@google.com>
    Link: https://lore.kernel.org/r/20240702-fs-lock-recover-2-v1-1-edd456f63789@google.com
    Reviewed-by: Jeff Layton <jlayton@kernel.org>
    Signed-off-by: Christian Brauner <brauner@kernel.org>

Signed-off-by: Bill O'Donnell <bodonnel@redhat.com>

Author: Bill O'Donnell

fs/locks.c

@@ -2364,8 +2364,9 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd,
 	error = do_lock_file_wait(filp, cmd, file_lock);
 
 	/*
-	 * Attempt to detect a close/fcntl race and recover by releasing the
-	 * lock that was just acquired. There is no need to do that when we're
+	 * Detect close/fcntl races and recover by zapping all POSIX locks
+	 * associated with this file and our files_struct, just like on
+	 * filp_flush(). There is no need to do that when we're
 	 * unlocking though, or for OFD locks.
 	 */
 	if (!error && file_lock->fl_type != F_UNLCK &&
@@ -2380,9 +2381,7 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd,
 		f = files_lookup_fd_locked(files, fd);
 		spin_unlock(&files->file_lock);
 		if (f != filp) {
-			file_lock->fl_type = F_UNLCK;
-			error = do_lock_file_wait(filp, cmd, file_lock);
-			WARN_ON_ONCE(error);
+			locks_remove_posix(filp, files);
 			error = -EBADF;
 		}
 	}